From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM11-BN8-obe.outbound.protection.outlook.com (NAM11-BN8-obe.outbound.protection.outlook.com [40.107.236.43]) by mx.groups.io with SMTP id smtpd.web12.61544.1595872162099320044 for ; Mon, 27 Jul 2020 10:49:22 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@amdcloud.onmicrosoft.com header.s=selector2-amdcloud-onmicrosoft-com header.b=1wzP2hXb; spf=none, err=SPF record not found (domain: amd.com, ip: 40.107.236.43, mailfrom: thomas.lendacky@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=F8oJsvi9FtjCHW8RVyxL0mwX496JkiEEQ9elTKho8TG7MsMEUEwmSs4JLo6NIWIn1yPvtFsJa0VT52RvVMi1UoJ0ip8yMzkvrr0oGtpKRAuFUiXXKIJdyN8zHCt5spSYji3zunrwfNRRlM9ALK1LCZPbUPcuP7DJXS70eXFu26p+WsXL/P1x/10J2B2dSSjF8mh8up8n0abFFIF0KUB1H49ljcQ490WYQCforaPUw6z/VvNyJaFR8XC+UGCIxVOXDzumqAYH4/Alk4WeMo36IxKGe4jjAOwwGOj8GQ2WeYoulrRvfH1sHh97TOUBFP9Xc2eyshJmEOwy1M16ZxTfbQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rv+lVaoksCL0IgG72tK2UuRbTkQh1HdIcrlhOGSmyug=; b=IhAlHMWHZaugMT44WYqVBwyrYy6PSUn1A/VHRA5QqXTjr8gIsUCZ3o2cJ8gggwFTwOLdhMmknB4ptJzjHPAlrwB9LFyWm4a+OyVFS/QDlO5xuMgVfCXXQjsQ+/CoUqUKmMiXCEikMQQ2xKu4A3I0altXJV7O0cFCkMf+OWda89skRtUh1xakB2FC0nC8wQ1rDSQFbnykWF/ItW/vvPIQ3e4dhJAICbXaVH+umJhIJQzHYhJ+GFVqTY/l+BSMQoIHvBC+vga1/pORc0TtU6Jz4ZG3HxM2cG+s0UBBqvMwVOO+dELKr3z/JMLpjRXauSKECj04VfAUENj9oo6skrzQ6Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amdcloud.onmicrosoft.com; s=selector2-amdcloud-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=rv+lVaoksCL0IgG72tK2UuRbTkQh1HdIcrlhOGSmyug=; b=1wzP2hXbUyUA4/r5Tux/ww5TyqzqEHcM+g+x5glby/MGrYgX0N5HWqmpAokascamT/F/aZcAMzllN4rl7M3WBj2TNRiOam0G1+7eFGR8NzUCEjPTKaNNcCfGuigz4HGCFXTKd5GOSoMrPi2rZnlITBqQFDzZRVQtg7y9gKg2000= Authentication-Results: intel.com; dkim=none (message not signed) header.d=none;intel.com; dmarc=none action=none header.from=amd.com; Received: from DM5PR12MB1355.namprd12.prod.outlook.com (2603:10b6:3:6e::7) by DM5PR12MB2358.namprd12.prod.outlook.com (2603:10b6:4:b3::34) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.21; Mon, 27 Jul 2020 17:49:19 +0000 Received: from DM5PR12MB1355.namprd12.prod.outlook.com ([fe80::25ec:e6ba:197c:4eb0]) by DM5PR12MB1355.namprd12.prod.outlook.com ([fe80::25ec:e6ba:197c:4eb0%8]) with mapi id 15.20.3216.031; Mon, 27 Jul 2020 17:49:19 +0000 Subject: Re: [edk2-devel] [PATCH v12 00/46] SEV-ES guest support To: Laszlo Ersek , devel@edk2.groups.io Cc: Brijesh Singh , Ard Biesheuvel , Eric Dong , Jordan Justen , Liming Gao , Michael D Kinney , Ray Ni , Andrew Fish , Anthony Perard , Benjamin You , Dandan Bi , Guo Dong , Hao A Wu , Jian J Wang , Julien Grall , Leif Lindholm , Maurice Ma References: <78601308-ff64-3af4-ffdd-2fccfd49f64a@redhat.com> From: "Lendacky, Thomas" Message-ID: <3890a4e7-7095-8570-a4b2-8e4cc6116b49@amd.com> Date: Mon, 27 Jul 2020 12:49:17 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.10.0 In-Reply-To: X-ClientProxiedBy: SN4PR0401CA0032.namprd04.prod.outlook.com (2603:10b6:803:2a::18) To DM5PR12MB1355.namprd12.prod.outlook.com (2603:10b6:3:6e::7) Return-Path: thomas.lendacky@amd.com MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from [10.236.30.118] (165.204.77.1) by SN4PR0401CA0032.namprd04.prod.outlook.com (2603:10b6:803:2a::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3216.23 via Frontend Transport; Mon, 27 Jul 2020 17:49:18 +0000 X-Originating-IP: [165.204.77.1] X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: 9a6d9f69-41d7-48e2-e205-08d83255635d X-MS-TrafficTypeDiagnostic: DM5PR12MB2358: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4941; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: MpptzmDAgCYsP84OzAlRT5uvaGsH3YP3tB9PdRuyEFesoPyfsq1nZR4FmN+5adZ+v7DfoLEoJPRlvDNda05IelRdVi2FYyDbNrXR0Eu/fO97ZiLsmHI+M2AgulrxoDWJRudAD6j0Ebn/8feD/Naraqe5DkfXmkr3gW6qeq+C2U5ICceo5277P8U+8SBqAxT7892YKbi8P1Xn3Nmp3zNl79/P+SPsF5JB6VssrW7mHBqlRYAXEf6MqQJlMoXuUm5gy8O/bKU7PzcCCOh/4OoBYEhFo5lcnAywNjwSJRf4aio8x/q20LEvup7AZMCOIDdY+CgPeUHmnAPfIC1DRf5yHDpfr9DsNIBqW/OhepqMYKRISSdLP4Gyj2bLIoe2ObIhWhcaK8/y3U3oUN7UatqA6WZOtqViqK1kyXY/QUa7HpuTq6GeznV2aEvZNxKpw9PmAqqIcifde0+qb2jErT5zMQ== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DM5PR12MB1355.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFTY:;SFS:(4636009)(39860400002)(396003)(346002)(136003)(376002)(366004)(66946007)(52116002)(83380400001)(53546011)(956004)(36756003)(86362001)(31696002)(2906002)(316002)(4326008)(31686004)(45080400002)(6486002)(8936002)(66556008)(66476007)(26005)(2616005)(7416002)(5660300002)(54906003)(16576012)(966005)(16526019)(186003)(8676002)(478600001)(43740500002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData: E0GMfE6DZldrVUdNX979JenynZjSemFMciwyHa20zok/r/h/SD6JPTcphLN+iIAuCGXnPm+WNJaEptXrt56O72HQnrfotvQpN+uuqNbwaX6jW7LXpkBrWyNJ8TC9QXxUQbuLTcAEobttCwyw3BB83YtSkOcK3/ojQoh7nb9rISezoAy3EiOeDT0genWuzTyXPs5J+EWbr3/hQxFBLHs3Ovr7LC/eae8yML6kdba13nKXF7UZ9SR+vSiDwxtpEFxjNFXXgF0nvMMwmpjrOeccZxAQ268Shhr9jkW6xVOinRmiMCR3HDA9EvlVkmbCcqzbBAnU6MiukJObniYJPLGjLTP8fa7VzvUQ2JHlOdrGlrto7ZtDPNcRoKTR37HJmFORVWRj9MHbjympxqF+Fe7qGxpBSULlV3AcybGUgTaxp+3t2Gc/EL5WhkpaGQI/wV0nx8rxuLNQ9tcSaKHhWhTOAvDhrw7Kbo2TycDMN+FL6vw= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 9a6d9f69-41d7-48e2-e205-08d83255635d X-MS-Exchange-CrossTenant-AuthSource: DM5PR12MB1355.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Jul 2020 17:49:19.5590 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: nsFeC/l4I1O1UQvSNp5Nzbb0d70T0icCg206uSplYaMHaYmN61Cgs8SOp+G1i9r1KKwX49/6Bn31TLPffGbGXw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR12MB2358 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit On 7/27/20 12:43 PM, Laszlo Ersek wrote: > On 07/27/20 19:41, Laszlo Ersek wrote: >> Hi Tom, Hi Laszlo, >> >> On 07/27/20 17:25, Lendacky, Thomas wrote: >>> From: Tom Lendacky >>> >>> This patch series provides support for running EDK2/OVMF under SEV-ES. >>> >>> Secure Encrypted Virtualization - Encrypted State (SEV-ES) expands on the >>> SEV support to protect the guest register state from the hypervisor. See >>> "AMD64 Architecture Programmer's Manual Volume 2: System Programming", >>> section "15.35 Encrypted State (SEV-ES)" [1]. >>> >>> In order to allow a hypervisor to perform functions on behalf of a guest, >>> there is architectural support for notifying a guest's operating system >>> when certain types of VMEXITs are about to occur. This allows the guest to >>> selectively share information with the hypervisor to satisfy the requested >>> function. The notification is performed using a new exception, the VMM >>> Communication exception (#VC). The information is shared through the >>> Guest-Hypervisor Communication Block (GHCB) using the VMGEXIT instruction. >>> The GHCB format and the protocol for using it is documented in "SEV-ES >>> Guest-Hypervisor Communication Block Standardization" [2]. >>> >>> The main areas of the EDK2 code that are updated to support SEV-ES are >>> around the exception handling support and the AP boot support. >>> >>> Exception support is required starting in Sec, continuing through Pei >>> and into Dxe in order to handle #VC exceptions that are generated. Each >>> AP requires it's own GHCB page as well as a page to hold values specific >>> to that AP. >>> >>> AP booting poses some interesting challenges. The INIT-SIPI-SIPI sequence >>> is typically used to boot the APs. However, the hypervisor is not allowed >>> to update the guest registers. The GHCB document [2] talks about how SMP >>> booting under SEV-ES is performed. >>> >>> Since the GHCB page must be a shared (unencrypted) page, the processor >>> must be running in long mode in order for the guest and hypervisor to >>> communicate with each other. As a result, SEV-ES is only supported under >>> the X64 architecture. >>> >>> [1] https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.amd.com%2Fsystem%2Ffiles%2FTechDocs%2F24593.pdf&data=02%7C01%7Cthomas.lendacky%40amd.com%7Cb388414fce2747ca9fef08d832549c1e%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637314686421485283&sdata=q1XqA0IvSWYmCHqRFQ704595cECr6MH6MXIJBoKAkog%3D&reserved=0 >>> [2] https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdeveloper.amd.com%2Fwp-content%2Fresources%2F56421.pdf&data=02%7C01%7Cthomas.lendacky%40amd.com%7Cb388414fce2747ca9fef08d832549c1e%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637314686421485283&sdata=EfLCdVJ9EcGQxBRv79NLLrZ8vyiCxepLbkNM%2FsQMOf0%3D&reserved=0 >>> >>> --- >>> >>> These patches are based on commit: >>> 6074f57e5b19 ("MdePkg/Include/IndustryStandard: Main CXL header") >>> >>> A version of the tree can be found at: >>> https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FAMDESE%2Fovmf%2Ftree%2Fsev-es-v20&data=02%7C01%7Cthomas.lendacky%40amd.com%7Cb388414fce2747ca9fef08d832549c1e%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637314686421485283&sdata=auEp%2Fd6Ju4V3BYG5UW%2BzwJzDersXm%2BuziQnB%2FPLDnYg%3D&reserved=0 >>> >>> Cc: Andrew Fish >>> Cc: Anthony Perard >>> Cc: Ard Biesheuvel >>> Cc: Benjamin You >>> Cc: Dandan Bi >>> Cc: Eric Dong >>> Cc: Guo Dong >>> Cc: Hao A Wu >>> Cc: Jian J Wang >>> Cc: Jordan Justen >>> Cc: Julien Grall >>> Cc: Laszlo Ersek >>> Cc: Leif Lindholm >>> Cc: Liming Gao >>> Cc: Maurice Ma >>> Cc: Michael D Kinney >>> Cc: Ray Ni >>> >>> Changes since v11: >>> - Make the XGETBV and VMGEXIT .nasm files buildable for all environments >>> and remove the updates that add these instructions to GccInline.c >> >> Patches 40-46 (inclusive) seem to be missing from my mailbox (and the >> list archive on groups.io lacks them too, apparently). >> >> Did you get rate-limited by some component when sending the series, perhaps? > > On a second / closer look, that seems quite likely, because my INBOX > does have all the (directly delivered) patches; only my list folder is > missing the tail. Yes, I always get an error when I reach 40 emails: Reported error: 550 5.0.350 Remote server returned an error -> 500 We have received more than 40 messages in 30 minutes from you. To guard against autoresponder mail loops, we must reject additional messages from you temporarily. Please try again later. So I usually have to wait a few hours and resend the last ones so they make it to groups.io. Thanks, Tom > > Thanks > Laszlo >